According to an example implementation, a non-transitory computer-readable storage medium is provided that includes computer-readable instructions stored thereon that, when executed, are configured to cause a processor to at least: store a relationship definition including one or more selectors identifying events participating in the relationship and one or more constraints between the events, at least one of the constraints expressed in terms of one or more relationship parameters. The instructions further cause the processor to receive one or more events, evaluate the received events against the one or more selectors, create a candidate relationship when the relationship parameters have been defined based on receiving one or more events that match one or more of the selectors, and convert the candidate relationship to a relationship instance when a minimum number of events matching each of the selectors are received.